TktView

FAQ

• Q: Why can't I get it to compile?
  A: You need the Windows 2000 platform SDK. Make sure those headers are included before the Visual C++ headers.

• Q: Why can't I get it to link?
  A: You need the Windows 2000 platform SDK. Make sure its libraries are included before the Visual C++ libraries.

• Q: Why can't I get it to run?
  A: You need Windows 2000 :-)

• Q: Where should I look to find the LSA code?
  A: Look in TktViewMainWnd.cpp

• Q: Why doesn't the "Purge all tickets for PRINCIPAL" work?
  A: This was one of the issues I mentioned in the article. For some reason, specifying a filter when purging gives this error. I'm currently working on an answer. Keep your eye on my Security Briefs support site for details.

• Q: Where can I get the article you just mentioned?
  A: At msdn magazine online, or at my Security Briefs support site, I've got a list of all my articles with current links to the online versions.

• Q: Why after I purge my ticket cache can I still reach remote file systems?
  A: SMB (Server Message Block) is connection oriented. As long as you still have an SMB session open, the client will not reauthenticate with the server, and thus will not need a ticket (it already authenticated earlier with a ticket that you subsequently purged from the cache). At this point, all the SMB client needs is the session key to continue to authenticate the packets that you send (and it doesn't even need this unless you've turned on SMB signing). To close the session, open the computer management snapin for the file server you're connecting to, drill down into System Tools/Shared Folders/Sessions and forceably close the session (only do this if you know that you aren't going to cream any programs that have open files/pipes - like if you're just experimenting with the ticket cache).

  Comments? Bugs?

  Send mail to kbrown@develop.com